Mel Gorman f1181047ff mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries ... commit 3ea277194d upstream. Stable note for 4.4: The upstream patch patches madvise(MADV_FREE) but 4.4 does not have support for that feature. The changelog is left as-is but the hunk related to madvise is omitted from the backport. Nadav Amit identified a theoritical race between page reclaim and mprotect due to TLB flushes being batched outside of the PTL being held. He described the race as follows: CPU0 CPU1 ---- ---- user accesses memory using RW PTE [PTE now cached in TLB] try_to_unmap_one() ==> ptep_get_and_clear() ==> set_tlb_ubc_flush_pending() mprotect(addr, PROT_READ) ==> change_pte_range() ==> [ PTE non-present - no flush ] user writes using cached RW PTE ... try_to_unmap_flush() The same type of race exists for reads when protecting for PROT_NONE and also exists for operations that can leave an old TLB entry behind such as munmap, mremap and madvise. For some operations like mprotect, it's not necessarily a data integrity issue but it is a correctness issue as there is a window where an mprotect that limits access still allows access. For munmap, it's potentially a data integrity issue although the race is massive as an munmap, mmap and return to userspace must all complete between the window when reclaim drops the PTL and flushes the TLB. However, it's theoritically possible so handle this issue by flushing the mm if reclaim is potentially currently batching TLB flushes. Other instances where a flush is required for a present pte should be ok as either the page lock is held preventing parallel reclaim or a page reference count is elevated preventing a parallel free leading to corruption. In the case of page_mkclean there isn't an obvious path that userspace could take advantage of without using the operations that are guarded by this patch. Other users such as gup as a race with reclaim looks just at PTEs. huge page variants should be ok as they don't race with reclaim. mincore only looks at PTEs. userfault also should be ok as if a parallel reclaim takes place, it will either fault the page back in or read some of the data before the flush occurs triggering a fault. Note that a variant of this patch was acked by Andy Lutomirski but this was for the x86 parts on top of his PCID work which didn't make the 4.13 merge window as expected. His ack is dropped from this version and there will be a follow-on patch on top of PCID that will include his ack. [akpm@linux-foundation.org: tweak comments] [akpm@linux-foundation.org: fix spello] Link: http://lkml.kernel.org/r/20170717155523.emckq2esjro6hf3z@suse.de Reported-by: Nadav Amit <nadav.amit@gmail.com> Signed-off-by: Mel Gorman <mgorman@suse.de> Cc: Andy Lutomirski <luto@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2017-08-11 09:08:50 -07:00
..
acpi	Merge branch 'acpi-pci'	2015-11-07 01:30:10 +01:00
asm-generic	asm-generic: make copy_from_user() zero the destination properly	2016-09-24 10:07:45 +02:00
clocksource
crypto	crypto: ahash - Fix EINPROGRESS notification callback	2017-04-21 09:30:06 +02:00
drm	drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces	2017-04-12 12:38:33 +02:00
dt-bindings	ARM: DT updates for v4.4	2015-11-10 15:06:26 -08:00
keys
kvm	KVM: arm/arm64: arch_timer: Preserve physical dist. active state on LR.active	2015-11-24 18:07:40 +01:00
linux	mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries	2017-08-11 09:08:50 -07:00
math-emu
media	videobuf2-core: Check user space planes array in dqbuf	2016-05-04 14:48:50 -07:00
memory
misc
net	net: ipv6: Compare lwstate in detecting duplicate nexthops	2017-07-21 07:44:55 +02:00
pcmcia
ras
rdma	RDMA/core: Fix incorrect structure packing for booleans	2017-03-12 06:37:29 +01:00
rxrpc
scsi	scsi: libiscsi: add lock around task lists to fix list corruption regression	2017-03-26 12:13:19 +02:00
soc	ARM: at91: define LPDDR types	2017-03-12 06:37:24 +01:00
sound	ALSA: rawmidi: Make snd_rawmidi_transmit() race-free	2016-02-17 12:30:58 -08:00
target	iscsi-target: Fix initial login PDU asynchronous socket close OOPs	2017-08-11 09:08:49 -07:00
trace	tracing: Add #undef to fix compile error	2017-03-18 19:09:57 +08:00
uapi	USB: hub: fix SS max number of ports	2017-06-26 07:13:09 +02:00
video	drm/imx: Match imx-ipuv3-crtc components using device node in platform data	2016-06-07 18:14:37 -07:00
xen	xen: Fix page <-> pfn conversion on 32 bit systems	2016-05-11 11:21:14 +02:00
Kbuild